Rebuild Piggy's interface, and give the demo book a business to describe

Piggy answered in raw markdown, threw away every tool result it streamed,
and fought the reader's scroll on every token. The three surfaces that
made it worth having — what it read, how it reasoned, what it cost — were
all on the wire and none of them reached the screen.

The transcript is now composed of five parts under components/piggy:
answers render through streamdown, the container sticks to the bottom
without pinning the reader there, tool steps say what they read and link
to the record, and each turn carries its model and token count. Three
lifecycle bugs went with them: Stop left a permanent spinner, a truncated
stream was indistinguishable from thinking, and a failed send destroyed
the message it failed to send.

Underneath, the inference path grew timeouts, jittered retries on 429 and
5xx, tolerance of the malformed frames a 30B model emits, and an
agent_runs row per turn so chat spend is observable. The system prompt now
states that a field ending in Cents is cents — without it nemotron renders
costPerGpuHourCents: 189 as "$189 per GPU-hour", which is a 100x error on
the most scrutinised number in the room.

The demo book was arithmetically incoherent: every deal's value
contradicted its own allocation revenue by up to 3.6x, nothing had ever
closed, no customer had any paper, and the marketplace was empty. Deal
value is now derived from the allocation, the book clears 5.3% across five
blocks with one deliberately underwater, and the renewal, compliance and
agent-provenance machinery finally has rows to act on. A --clear that
deleted every obligation, SLA term and capacity request in the database
regardless of origin is scoped to the demo's own ids.

Around that: accounts have a detail page, ⌘K searches the book, Settings
can mint the API keys it always claimed to, and deploy.sh actually ships
the agent instead of silently skipping its compose profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -88,6 +88,12 @@ services:
       - '127.0.0.1:${PIG_HOST_PORT:-8920}:8920'
 
   piggy:
+    # Off unless asked for: a `compose up` with no profile starts the CRM alone.
+    # Every command that must reach this service — pull, build, up — needs
+    # `--profile piggy` (or COMPOSE_PROFILES=piggy), and without it compose
+    # skips the service in silence, exit 0 and no warning. scripts/deploy.sh
+    # derives the profile from PIGGY_ENABLED in .env, so the agent is upgraded
+    # with the app rather than left running the image it was started on.
     profiles: ['piggy']
     # Same reference as `app`, deliberately — see the note there.
     image: ${PIG_IMAGE:-pig:local}
@@ -97,16 +103,53 @@ services:
       db:
         condition: service_healthy
     command: ['npx', 'tsx', 'apps/piggy/src/main.ts']
+    # Listed rather than mapped, unlike `app`, and the difference is
+    # load-bearing. A bare `KEY` takes its value from .env when set there and is
+    # left OUT of the container environment when absent, so
+    # apps/piggy/src/config.ts stays the one place a default is written. The
+    # mapped `${KEY:-}` form would pass an empty string instead, and Piggy's
+    # config coerces: an empty PIGGY_MAX_TOKENS becomes 0 and fails the
+    # positive-integer check at boot, an empty PIGGY_WORKER_ID becomes the lease
+    # identity every worker shares — the one thing a lease exists to prevent.
+    # A blank line in .env still passes the empty string, which is why the
+    # optional keys are commented out in .env.example rather than left blank.
     environment:
-      DATABASE_URL: postgres://${POSTGRES_USER:-pig}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-pig}
-      PIGGY_INFERENCE_API_KEY: ${PIGGY_INFERENCE_API_KEY:-}
-      PIGGY_INFERENCE_BASE: ${PIGGY_INFERENCE_BASE:-https://api.pinference.ai/api/v1}
-      PIGGY_MODEL: ${PIGGY_MODEL:-nvidia/nemotron-3-nano-30b-a3b}
-      PIGGY_LEASE_SECONDS: ${PIGGY_LEASE_SECONDS:-300}
-      PIGGY_INTERNAL_TOKEN: ${PIGGY_INTERNAL_TOKEN:-}
-      PIGGY_CHAT_HOST: 0.0.0.0
-      PIGGY_CHAT_PORT: 8931
-      PIGGY_CHAT_ALLOW_NON_LOOPBACK: 'true'
+      - DATABASE_URL=postgres://${POSTGRES_USER:-pig}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-pig}
+      - PIGGY_INFERENCE_API_KEY
+      - PIGGY_INFERENCE_BASE
+      - PIGGY_MODEL
+      - PIGGY_LEASE_SECONDS
+      - PIGGY_POLL_INTERVAL_MS
+      - PIGGY_MAX_TOKENS
+      - PIGGY_CHAT_MAX_TOKENS
+      - PIGGY_MAX_TURNS
+      - PIGGY_REASONING_EFFORT
+      - PIGGY_PRICE_INPUT_CENTS_PER_MTOK
+      - PIGGY_PRICE_OUTPUT_CENTS_PER_MTOK
+      - PIGGY_WORKER_ID
+      - PIGGY_INTERNAL_TOKEN
+      # Fixed for this container rather than configurable: the API calls the
+      # chat server across the Compose network, so it cannot bind loopback only.
+      # Safe because the port below is exposed, never published.
+      - PIGGY_CHAT_HOST=0.0.0.0
+      - PIGGY_CHAT_PORT=8931
+      - PIGGY_CHAT_ALLOW_NON_LOOPBACK=true
+    # The image's own HEALTHCHECK asks for :8920/api/health, which only the API
+    # process serves. Inherited unchanged, this container reports unhealthy for
+    # ever while answering chat perfectly — and a health status that is always
+    # wrong is worse than none, because it teaches the operator to ignore the
+    # column. Piggy's listener answers /internal/health without a token for
+    # exactly this purpose.
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:8931/internal/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
     # Private to the Compose network. There is deliberately no `ports` entry.
     expose:
       - '8931'